1 providing all the pending claims, as they now stand, 

I incorporating the charig^s^ 

1 Please cancel claims 1-6 and 8-29. 

I Rewrite claim 7 as follows: 

1 (Amended) [The method of claim 5] A method of 

2 processing and storing data in a computer system including 

3 processor circuitry, and a data storage device, the method 

4 comprising the steps of: 

5 storing first and second sets of records in 

6 separate first-in, first-out data structures, respectively, 

7 on the data storage device, the first and second sets of 

8 records being of different data resolutions and 

9 corresponding to overlapping periods of time; 

10 operating the processor circuitry to receive data 

11 collected over a period of time; and 

12 operating the processor circuitry to update at 

13 least one record in each of the stored first and second 

14 sets of records with the received data such that a previous 

15 record included in each of the first and second data 

16 structures is replaced; 

17 periodically collecting network traffic data, wherein 

18 the collected network traffic data includes byte and packet 

19 count information associated with each of a plurality of 

20 monitored conversations between devices included in the 

21 computer system^ 

22 storing the collected network traffic data in a 

23 buffer; and 
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operating the processor circuitry to retrieve network 
traffic data from the buffer, the retrieved network traffic 
data being received by the processor circuitry; 

[,] wherein the step of operating the processor 
circuitry to update at least one record in each of the 
stored first and second sets of records [including] 
includes the steps of: 

updating a record corresponding to a first 
conversation in the first set of records; and 

updating a record corresponding to the first 
conversation in the second set of records. — . 



Please add the following new claims: 




/ 



-CStfT The method of claim further comprising the 

step of: 

allocating fixed amounts of storage space on the 
data storage device for storing each one of the first and 
second first-in, first-out data structures used to store 
the first and second sets of records. 



^&L. The method of claim/7, wherein the first set of 
records include hourly records and the second set of 
records includes daily records. 




1, 



The method of claim 

wherein the network traffic data stored in the 
buffer includes time stamp information indicating the 
period of time in which the network traffic data was 
collected; and 
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wherein the step of operating the processor 
circuitry to update at least one record in each of the 
stored first and second sets of records includes the step 
of: 

examining at least one time stamp included in the 
buffered network traffic data. 

4 t 

The method of claim,^ 

wherein the processor circuitry includes first 
and second central processing units, and 

wherein the step of operating the processor 
circuitry to update at least one record in each of the 
stored first and second sets of records includes the step 
of operating the first processor to update the first set of 
records while operating the second processor to update the 
second set of records. 

t- i 

_>T; The method of claim/7, wherein the computer system 
further includes a display device, the method further 
comprising the step of: 

displaying data corresponding to overlapping 
periods of time at different resolutions on the display 
device . 

1 

A computer system for monitoring network traffic data 
comprising : 

a memory; 

a data storage device; and 

a processor to execute instructions stored in the 

memory, 

wherein the memory stores: 
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8 instructions to store first and second sets 

9 of records in separate first-in, first-out data structures, 

10 respectively, on the data storage device, the first and 

11 second sets of records being of different data resolutions 

12 and corresponding to overlapping periods of time; 

13 instructions to receive data collected over 

14 a period of time; 

15 instructions to update at least one record 

16 in each of the stored first and second sets of records with 

17 the received data such that a previous record included in 

18 each of the first and second data structures is replaced; 

19 instructions to. periodically collect network 

0 traffic data, wherein the collected network traffic data 

21 includes byte and packet count information associated with 

22 each of a plurality of monitored conversations between 

23 devices included in the computer system; 

24 instructions to store the collected network 

25 traffic data in a buffer; and 

26 instructions to retrieve network traffic 

27 data from the buffer, the retrieved network traffic data 

28 being received by the processor; 

29 wherein the instructions to update at least one record 

30 in each of the stored first and second sets of records 

31 include instructions to: 

32 update a record corresponding to a first 

33 conversation in the first set of records; and 

34 update a record corresponding to the first 

35 conversation in the second set of records. 

1 j^ 0 ^- The computer system of claim Jf€, wherein the memory 

2 further comprises instructions to: 
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3 allocate fixed amounts of storage space on the 

4 data storage device for storing each one of the first and 

5 second first-in, first-out data structures used to store 

6 the first and second sets of records. 

1 . The computer system of claim wherein the first set 

2 of records include hourly records and the second set of 

3 records includes daily records. 

(6 1 

1 JJH'. The computer system of claim J#o f 

2 wherein the network traffic data stored in the 

3 buffer includes time stamp information indicating the 
period of time in which the network traffic data was 

5 collected; and 

6 wherein the instructions to update at least one 

7 record in each of the stored first and second sets of 

8 records include instructions to: 

9 examine at least one time stamp included in the 

10 buffered network traffic data. 

11 T ^ e computer system of claim ^*f, 

12 wherein the processor includes first and second 

13 central processing units, and 

14 wherein the instructions to operate the processor 

15 to update at least one record in each of the stored first 

16 and second sets of records includes instructions to operate 

17 the first processor to update the first set of records 

18 while operating the second processor to update the second 

19 set of records. 
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^frff. The computer system of claim further including a 
display device, the memory further comprising instructions 
to: 

display data corresponding to overlapping periods 
of time at different resolutions on the display device. 

^jrf. A computer program product system for monitoring 
network traffic data, said computer program product 
comprising a computer usable medium having computer 
readable program code means embodied in said medium for 
causing a processor in a computer to: 

store first and second sets of records in separate 
first-in, first-out data structures, respectively, on a 
data storage device, the first and second sets of records 
being of different data resolutions and corresponding to 
overlapping periods of time; 

receive data collected over a period of time; 

update at least one record in each of the stored first 
and second sets of records with the received data such that 
a previous record included in each of the first and second 
data structures is replaced; 

periodically collect network traffic data, wherein the 
collected network traffic data includes byte and packet 
count information associated with each of a plurality of 
monitored conversations between devices included in the 
computer system; 

store the collected network traffic data in a buffer; 

and 

retrieve network traffic data from the buffer, the 
retrieved network traffic data being received by the 
processor; 
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1 wherein the causing the processor to update at least 

2 one record in each of the stored first and second sets of 

3 records includes: 

4 updating a record corresponding to a first 

5 conversation in the first set of records; and 

6 updating a record corresponding to the first 

7 conversation in the second set of records. 



0 

1 The com P uter program product of claim Jf£, wherein the 

2 computer readable program code means further causes the 

3 processor to: 

4 allocate fixed amounts of storage space on the 

5 data storage device for storing each one of the first and 

6 second first-in, first-out data structures used to store 

7 the first and second sets of records. 

1 The computer program product of claim^J^, wherein the 

2 first set of records include hourly records and the second 

3 set of records includes daily records. 

1 The computer program product of claim AT, 

2 wherein the network traffic data stored in the 

3 buffer includes time stamp information indicating the 

4 period of time in which the network traffic data was 

5 collected; and 

6 wherein the computer readable program code means 

7 to update at least one record in each of the stored first 

8 and second sets of records includes computer readable 

9 program code means to examine at least one time stamp 
10 included in the buffered network traffic data. 
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